How to disable root SSH login (safely)

Allowing root to log in over SSH is one of the most common security weaknesses on a VPS. root exists on every Linux box, so attackers already know the username — they only need the password. Disabling root SSH removes that target entirely. Done carefully, it costs nothing in convenience.

Why disable root over SSH

• Known username. Bots hammer root constantly because it's guaranteed to exist.
• No accountability. When multiple people share the root login, logs can't tell who did what.
• All-or-nothing power. A compromised root session owns the whole machine instantly.

The safer model: log in as a normal user, then escalate with sudo only when needed.

The golden rule

Set up and test your replacement login BEFORE you disable root. Locking yourself out of a server you can only reach via SSH is the classic mistake. Follow the order below and it can't happen.

Step 1: Create a sudo user

As root:

adduser deploy
usermod -aG sudo deploy      # Ubuntu/Debian
# usermod -aG wheel deploy   # AlmaLinux/Rocky

Step 2: Give that user SSH key access

From your local machine, copy your public key to the new user:

ssh-copy-id deploy@YOUR_SERVER_IP

Step 3: Verify the new login works

Open a new terminal — don't close your root session yet — and confirm both login and sudo:

ssh deploy@YOUR_SERVER_IP
sudo whoami

If sudo whoami prints root, you're ready. If anything fails, fix it now while you still have the root session open.

Step 4: Disable root SSH

Edit the SSH server config:

sudo nano /etc/ssh/sshd_config

Find the PermitRootLogin line and set it to:

PermitRootLogin no

While you're here, disabling password authentication is an even bigger win (assuming your key works):

PasswordAuthentication no

Step 5: Apply the change

Reload the SSH service:

sudo systemctl restart ssh

Step 6: Confirm root is blocked

From your local machine, try to log in as root — it should be refused:

ssh root@YOUR_SERVER_IP

You should see Permission denied. Meanwhile your deploy login still works. Success.

What if something goes wrong?

If you somehow lose access, don't panic. Nxeon provides console access to your VPS from the dashboard, completely independent of SSH. You can log in directly at the console, undo the change in sshd_config, and restart SSH. That out-of-band console is exactly why disabling root SSH is low-risk on a managed VPS.

Newer sshd config layouts

Some distributions split SSH config into /etc/ssh/sshd_config.d/. A drop-in file there can override the main file, so if your change doesn't take effect, check that directory for a conflicting PermitRootLogin setting and adjust it too. Validate your config before restarting:

sudo sshd -t

A clean output means no syntax errors.

The payoff

With root SSH disabled and passwords off, the endless bot login attempts against root simply bounce. The only way in is your key, on your user — a dramatically smaller attack surface for two minutes of work. Make it part of your standard first-ten-minutes routine on every new server.